Export limit exceeded: 26045 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 25952 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 415620 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 415620 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 415620 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (2 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-58496 1 Thorvg 1 Thorvg 2026-10-28 4.3 Medium
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.
CVE-2026-45729 1 Thorvg 1 Thorvg 2026-06-02 4.3 Medium
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. This issue has been patched in version 1.0.5.